slugstring required
Internal source name, used in URLs.
promotedboolean
When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.
authentication_flowstring uuid nullable
Flow to use when authenticating existing users.
enrollment_flowstring uuid nullable
Flow to use when enrolling new users.
user_property_mappingsstring[]
group_property_mappingsstring[]
componentstring required
Get object component so that we know how to edit the object
verbose_namestring required
Return object's verbose_name
verbose_name_pluralstring required
Return object's plural verbose_name
meta_model_namestring required
Return internal model name
policy_engine_mode'all' | 'any'
user_matching_mode'identifier' | 'email_link' | 'email_deny' | 'username_link' | 'username_deny'
managedstring nullable required
Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
group_matching_mode'identifier' | 'name_link' | 'name_deny'
pre_authentication_flowstring uuid required
Flow used before authentication.
issuer_overridestring
Also known as Entity ID. Defaults to the Metadata URL.
url_issuerstring required
Get the resolved Issuer, falling back to the metadata URL when unset
sso_urlstring uri required
URL that the initial Login request is sent to.
slo_urlstring uri nullable
Optional URL if your IDP supports Single-Logout.
allow_idp_initiatedboolean
Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done.
force_authnboolean
When enabled, the IdP will re-authenticate the user even if a session exists.
name_id_policy'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
binding_type'REDIRECT' | 'POST' | 'POST_AUTO'
verification_kpstring uuid nullable
When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
signing_kpstring uuid nullable
Keypair used to sign outgoing Responses going to the Identity Provider.
digest_algorithm'http://www.w3.org/2000/09/xmldsig#sha1' | 'http://www.w3.org/2001/04/xmlenc#sha256' | 'http://www.w3.org/2001/04/xmldsig-more#sha384' | 'http://www.w3.org/2001/04/xmlenc#sha512'
signature_algorithm'http://www.w3.org/2000/09/xmldsig#rsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512' | 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
temporary_user_delete_afterstring
Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3).
encryption_kpstring uuid nullable
When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key.